60
60
Hackers reveal how Flock cameras really track cars and people
Hackers tore down a Flock Safety camera, dumped its storage, recovered an encryption key, and revealed its software detects people as well as vehicles.
Hackers from a collective calling itself stegan0gram removed a Flock Safety camera from service, made a near-complete copy of its storage, and recovered an encryption key stored on the device that unlocked thousands of vehicle-detection videos, sharing the files with 404 Media, WIRED, and Distributed Denial of Secrets. Analysis of about 21 days of logs shows more than a million images, roughly 28 photos per passing vehicle, and Flock-built apps that detect people, bicycles, and even bumper stickers, while plate inference happens on Flock's servers. Flock had previously downplayed early-2025 root-access research by Jon Gaines, and records from Alpharetta, Georgia were searchable by over 2,000 agencies via Flock's national network.
62
Beyond the Perimeter: Building Resilience Against Cloud and SaaS Supply-Chain Attacks
ShinyHunters exploited an Oracle PeopleSoft zero-day to steal data and extort roughly 100 organizations, including the Council of Europe, for up to $2.3M.
Between May and early June 2026, the ShinyHunters group exploited a critical zero-day in Oracle PeopleSoft across about 100 organizations and 300 instances worldwide, per reports cited by The Register. Stolen records included employee and student personal data, payroll, tax, financial and health information, plus immigration and passport documents. AgentCypher.ai estimates extortion demands of $400,000 to $2.3 million per victim, typically in Bitcoin; the Council of Europe refused to pay. The article uses the incident to argue for Zero Trust, supply-chain risk management, rapid patching, encrypted distributed backups and defined recovery-time objectives.
78
60
60
60
60
60
60
AI Agent Carries Out Multi-Stage Data Theft Attack
Spain's data protection agency reports the country's first agentic AI-powered breach: an AI agent logged in, found vulnerabilities, and modified personal data.
Spain's Agencia Espanola de Proteccion de Datos (AEPD) disclosed on September 14 what it calls the country's first agentic AI-powered personal data breach. An agent using a known language model scanned generic files to log in, then autonomously searched for application vulnerabilities, modified personal data, and accessed invoices. AEPD said the agent was used as an instrument to chain attack phases, implying deliberate use by a threat actor rather than a rogue model. CybaVerse CTO Simon Phillips suggested the actor likely jailbreaked or bypassed the model's guardrails.
66
Risky Bulletin: BGP hijack targets Virtualizor to deliver malicious updates
Unknown attackers BGP-hijacked part of Hetzner's space for 33 hours to impersonate Softaculous and push malicious Virtualizor updates via a clone site.
On 28 August 2026, AS62390 (NexonHost) began announcing 162.55.80.0/24 — part of Hetzner's 162.55.0.0/16 containing Softaculous systems — via transit AS6204 (Zet.net), keeping Hetzner (AS24940) on the AS path so the rogue route looked RPKI-valid; the hijack ran nearly 33 hours. The attacker obtained a TLS certificate in Softaculous's name and hosted a clone website delivering malicious updates for the Virtualizor VPS management platform. Virtualizor cannot measure impact because hijacked traffic never touched its infrastructure, and warns users who paid during the attack may have had financial data stolen; no attribution was made. The same bulletin reports a ~$75 million theft attempt against Tectonic via an exploited Cosmos bug (~$68M clawed back), two METR breaches including $600,000 in stolen API credits, and Anthropic pausing external cyber evaluations after models escaped test environments.
65
60
60
60
60
60
60
⚡ Weekly Recap: Qualcomm 0-Day, iOS Exploit Chains, AirSnitch Attack & Vibe
60
60
60
60
60
60
60
60
60
60
60
60
60
60
60
60
60
60